ci: bump GitHub Actions to Node 24 majors + add dependabot (#459)

* ci: bump actions to Node 24 majors

GitHub-hosted runners drop Node.js 20 on 2026-09-16 and force Node 24
as the default on 2026-06-02. The last release warned on every
`actions/upload-artifact@v4` invocation. Sweep every Node 20 action.

First-party:
  actions/upload-artifact          v4 -> v7
  actions/download-artifact        v4 -> v7  (skip v8 — hash-mismatch errors by default)
  actions/setup-python             v5 -> v6
  actions/upload-pages-artifact    v4 -> v5
  actions/deploy-pages             v4 -> v5

Third-party:
  docker/setup-qemu-action              v3 -> v4
  amannn/action-semantic-pull-request   v5 -> v6

Untouched (already Node 24 or auto-tracking):
  actions/checkout@v6, actions/cache@v5, astral-sh/setup-uv@v7,
  pypa/gh-action-pypi-publish@release/v1.

ci.yml has no Node 20 actions and is untouched.

* ci: add dependabot config for github-actions + python security

Catches future Node-version cutovers and action-side advisories
automatically. Two ecosystems:

- github-actions: weekly version updates, grouped into a single PR.
- uv: security advisories only (open-pull-requests-limit: 0).
  Version churn across the ~25 optional dependency groups would be
  noisy; security PRs always go through regardless of the limit.

Author: cofin

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: ci
+
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: deps

.github/workflows/docs.yml

@@ -27,7 +27,7 @@ jobs:
         run: uv run python tools/build_docs.py docs-build
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v5
         with:
           path: docs-build
 
@@ -47,4 +47,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/pgo-validate.yml

@@ -12,7 +12,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 

.github/workflows/pr-title.yml

@@ -15,6 +15,6 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/publish.yml

@@ -26,7 +26,7 @@ jobs:
         run: uv build --sdist
 
       - name: Upload source artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: source-dist
           path: dist/*.tar.gz
@@ -51,7 +51,7 @@ jobs:
         run: uv build --wheel
 
       - name: Upload wheel artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-standard
           path: dist/*.whl
@@ -67,12 +67,12 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: all
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -164,7 +164,7 @@ jobs:
             MYPYC_OPT_LEVEL=3 MYPYC_DEBUG_LEVEL=0 MYPYC_MULTI_FILE=1
 
       - name: Upload wheel artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-mypyc-py${{ matrix.python-version }}
           path: wheelhouse/*.whl
@@ -191,13 +191,13 @@ jobs:
         run: uv python install ${{ matrix.python-version }}
 
       - name: Download standard wheel artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: wheels-standard
           path: dist-standard/
 
       - name: Download mypyc wheel artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: wheels-mypyc-*
           merge-multiple: true
@@ -230,7 +230,7 @@ jobs:
         uses: astral-sh/setup-uv@v7
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: "*"
           merge-multiple: true

.github/workflows/test-build.yml

@@ -43,7 +43,7 @@ jobs:
         run: uv build --sdist
 
       - name: Upload source artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: source-dist
           path: dist/*.tar.gz
@@ -68,7 +68,7 @@ jobs:
         run: uv build --wheel
 
       - name: Upload wheel artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-standard
           path: dist/*.whl
@@ -85,12 +85,12 @@ jobs:
 
       - name: Set up QEMU
         if: github.event.inputs.test_matrix == 'full'
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: all
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
@@ -151,7 +151,7 @@ jobs:
             CFLAGS="-fprofile-use=/tmp/sqlspec-pgo -fprofile-correction -Wno-error=missing-profile -Wno-error=coverage-mismatch"
 
       - name: Upload wheel artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: wheels-mypyc-py${{ matrix.python-version }}
           path: wheelhouse/*.whl
@@ -178,13 +178,13 @@ jobs:
         run: uv python install ${{ matrix.python-version }}
 
       - name: Download standard wheel artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: wheels-standard
           path: dist-standard/
 
       - name: Download mypyc wheel artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: wheels-mypyc-*
           merge-multiple: true
@@ -211,7 +211,7 @@ jobs:
         uses: astral-sh/setup-uv@v7
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: "*"
           merge-multiple: true